PT-2017-4233 · Xmlsoft+2 · Libxml2+2

Henri Salo · Published 2017-02-12 · Updated 2024-08-05 · CVE-2017-5969

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.4

Description The issue is related to a denial of service caused by a NULL pointer dereference when libxml2 is used in recover mode. This can be triggered by a remote attacker via a crafted XML document. The maintainer of libxml2 has stated that the Recover parsing option should only be used for manual recovery, at least for the XML parser.

Recommendations For libxml2 version 2.9.4, consider disabling the recover mode to prevent exploitation until a patch is available. As a temporary workaround, avoid using the recover parsing option for automatic processing of XML documents.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-1924

ALT-PU-2019-3079

BDU:2023-00218

CVE-2017-5969

DLA-2972-1

MGASA-2018-0048

OPENSUSE-SU-2024:11016-1

SUSE-SU-2017:1670-1

SUSE-SU-2017:1813-1

Affected Products

Alt Linux

Suse

Libxml2

References · 113

• https://bdu.fstec.ru/vul/2021-05256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318 · Security Note
• https://bdu.fstec.ru/vul/2019-00734 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5969 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5969 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956 · Security Note
• https://osv.dev/vulnerability/DLA-2972-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04730 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/686248 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/681982 · Security Note
• https://bdu.fstec.ru/vul/2022-01453 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9048 · Security Note
• https://bdu.fstec.ru/vul/2019-00518 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9251 · Security Note